Skip to content
Check a domain

WordPress security check · first check free

WordPress security check: what does your site tell the world?

See which WordPress version, plugins and themes your site reveals, which ones have known vulnerabilities, and what to update first. For a WordPress site you own, from the outside, nothing to install.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

  • No card for the free check
  • Results usually in minutes
  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription needed
  • View sample report

Quick Scan

Areas checked
11
In good shape
4
Fixes in minutes
3 of 5
  1. Medium

    Protect the session cookie

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

    Fix

    1. Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider.
    2. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors.
    3. When the reports show your real mail passes, move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 3 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

WordPress sites often announce their version and plugins in their pages and headers. We identify what's visible, match it against published vulnerability data and support dates, and put the updates that matter most at the top, along with your headers, HTTPS and email setup.

  • Your first check is free: create an account and confirm your email.
  • The WordPress version, plugins and themes your pages reveal, with their versions
  • Known vulnerabilities in what we find, most urgent first
  • No plugin to install and no login needed; it checks what the public can see

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription needed.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription needed.

  • One credit checks one website
  • Credits last 12 months
  • One-off payment, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work
Check my WordPress site

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

What we check

What we look for, WordPress included.Versions, plugins and known issues.

Part of every Quick Scan, alongside the other checks.

  • Platforms and versions

    The CMS, server, language and libraries your site announces, such as WordPress, Drupal, PHP, nginx or jQuery.

  • WordPress plugins and themes

    The ones your pages reveal, with their versions.

  • Known vulnerabilities

    Published issues in those versions, most urgent first, including ones known to be used in attacks.

  • End of life

    Release lines that no longer get security fixes.

  • Version give-aways

    Headers and page tags that announce versions to everyone.

  • WordPress remote access

    Whether the XML-RPC interface is advertised.

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your site announces PHP 7.4.3. PHP 7.4 stopped getting security fixes on 28 November 2022, so new problems in it won't be fixed.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host which PHP version really runs: the version a site announces can differ. Then move the site to a supported PHP version (8.x) and test it, as older code may need changes. Then stop announcing the version: set expose_php = Off.

F2 · cookie-flags

Protect the session cookie

Medium Confirmed Minutes

What it means
Your homepage sets a session cookie without the Secure and HttpOnly flags. Secure keeps it on encrypted connections; HttpOnly keeps it away from scripts in the page, so an injected script can't read it.
Evidence
Set-Cookie: PHPSESSID=…; path=/
              ↑ no Secure, no HttpOnly
Expected
Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax
Fix
Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.

Questions

Short answers.

Something else? support@scandefend.com

Is this a free WordPress scan?

It's part of a full website security check, from $8 a check with no subscription.

Does it check for malware or hacked files?

No. It's an outside check of what your site shows the public: versions, plugins, headers, HTTPS and email setup. It doesn't log in, scan files or remove malware.

Do I need to install a plugin?

No. Nothing to install and no WordPress login. The report tells you what to update; you or your developer make the changes.

Keep exploring

Also useful: What we check

See what your website shows.Know what to fix first.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

See pricing